Command Injection
Last updated
Last updated
Injection Operator
Injection Character
URL-Encoded Character
Executed Command
Semicolon
;
%3b
Both
New Line
%0a
Both
Background
&
%26
Both (second output generally shown first)
Pipe
|
%7c
Both (only second output is shown)
AND
&&
%26%26
Both (only if first succeeds)
OR
||
%7c%7c
Second (only if first fails)
Sub-Shell
``
%60%60
Both (Linux-only)
Sub-Shell
$()
%24%28%29
Both (Linux-only)
Injection Type
Operators
SQL Injection
' , ; -- /* */
Command Injection
; &&
LDAP Injection
* ( ) & |
XPath Injection
' or and not substring concat count
OS Command Injection
; & |
Code Injection
' ; -- /* */ $() ${} #{} %{} ^
Directory Traversal/File Path Traversal
../ ..\\ %00
Object Injection
; & |
XQuery Injection
' ; -- /* */
Shellcode Injection
\x \u %u %n
Header Injection
\r %0d %0a %09